Chinese state-aligned hackers used stolen ConnectWise credentials to reach thousands of customer environments
Because the intruders signed in as authorised users, the attack left little for defenders to spot before email and files were exposed.
Chinese state-aligned hackers, according to Microsoft researchers, breached IT management firm ConnectWise's cloud backup service and took application credentials that link ConnectWise to its corporate clients. With those credentials, the intruders could sign in to customers' Microsoft-hosted environments as if they were authorised users and reach email and files. Microsoft says the campaign reached roughly 2,250 organisations, with sign-in attempts running near 3,000 per minute, a pace it attributes to AI agents and says leaves defenders little time to respond. The tool named in the analysis is ARTEX, an open-source framework that pairs AI models with cyber-defence stress testing, and the same software was reportedly involved in a recent intrusion into South Korea's financial systems. ConnectWise has paused access to the backup system, is investigating, and said as of Thursday it was working to restore the service.
Why it matters
The campaign shows how a single provider's stolen credentials can open access to many downstream organisations at once. Customers of managed IT services now have to consider that a breach at their vendor can look like legitimate activity inside their own Microsoft environments. Microsoft's point about speed suggests that detection, not just prevention, will be the harder problem for those organisations while ConnectWise restores its backup service.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- TechCrunch